Webshell Remote Command Execution via Auditd

SigmaHQ Detections@sigmaHQ

•updated Jun 5, 2025•3•0•24

Detects possible command execution by a web application or web shell by monitoring `execve` and `execveat` syscalls initiated by the web server's user ID (e.g., euid 33 for www-data). This rule specifically targets Linux systems using auditd for logging, requiring a specific auditd configuration to capture these events.